Auth service

Identity boundary for Splick: registration, password and OTP login, Google and Apple sign-in, refresh-token rotation, trial and admin operations, account closure, and publication of user lifecycle events.

Bounded context	identity
Listen port	8081
PostgreSQL schema	auth
Source	splick-backend/services/auth-service

Responsibilities

• Own its schema and Flyway migrations. Other services call HTTP or consume events. They do not join this schema.
• Expose public routes only through Kong. Internal routes use the internal API key.
• Publish integration facts through the transactional outbox when this service produces events. The outbox relay is the publisher.

Kong prefixes

• /api/v1/auth
• /api/v1/admin/auth
• /api/v1/admin/users
• /api/v1/admin/trial-registrations
• /api/v1/admin/ops

Public clients use http://localhost:8080/api in dev and https://api.splick.app/api in production. Kong strips the /api prefix before the upstream.

Pages in this section

• Architecture
• API
• Data model
• Events
• Dependencies
• Configuration
• Observability
• Jobs
• Runbook
• Testing